47 lines
1.3 KiB
Python
47 lines
1.3 KiB
Python
"""
|
|
routes/rgpd.py — Droit à l'effacement RGPD (art. 17) : anonymisation des
|
|
données d'un utilisateur (identifié par son `sub` OIDC Keycloak).
|
|
|
|
Réservé aux administrateurs (@require_admin), au même titre que les autres
|
|
routes de modification (annonces, fichiers, blocks) — cf. auth_service.py.
|
|
"""
|
|
|
|
from flask import Blueprint, current_app, jsonify
|
|
|
|
from config import Config
|
|
from services import rgpd_service
|
|
from services.auth_service import client_ip, current_user, require_admin
|
|
|
|
bp = Blueprint("rgpd", __name__, url_prefix="/api/admin/users")
|
|
|
|
|
|
def _db():
|
|
return current_app.config["DB"]
|
|
|
|
|
|
def _pepper():
|
|
return getattr(Config, "RGPD_ANON_PEPPER", None) or Config.SECRET_KEY
|
|
|
|
|
|
@bp.route("/<sub>/data", methods=["DELETE"])
|
|
@require_admin
|
|
def anonymize_user_data(sub):
|
|
actor = current_user()
|
|
try:
|
|
result = rgpd_service.anonymize_user(
|
|
_db(), sub, _pepper(), actor.get("sub"), client_ip()
|
|
)
|
|
except rgpd_service.InvalidSubError as exc:
|
|
return jsonify({"error": str(exc)}), 400
|
|
|
|
if not result["anonymized"]:
|
|
return jsonify({"error": "aucune donnée trouvée pour cet utilisateur"}), 404
|
|
|
|
return jsonify(
|
|
{
|
|
"status": "anonymized",
|
|
"pseudonym": result["pseudonym"],
|
|
"rows_updated": result["rows"],
|
|
}
|
|
)
|